Issues upgrading from R80.10 to R80.30 (Route Redistribution + ClusterXL ARP)

[JulzorenSen]

Hi,

We are currently upgrading a bunch of gateways (mainly CP 2200 and 12200) from R80.10 (from a multitude of different JHF) to R80.30 (last JHF T135) and we are seing some serious issues, which caused us important downtime.

** Route Redistribution issue **

This one clearly looks like a bug on CheckPoint's side.

After upgrading a Gateway from R80.10 to R80.30, the route redistribution (Interfaces&Static to OSPF) doesn't work anymore.

* We can clearly see that the route Redistribution configuration is still present, both in CLI and in the fw GUI

* We can see the gateway in the OSPF Neigbhor list on the other side (Cisco Cat. 9500 router)

* But the Gateway doesn't redistribute the routes

After searching for half-an-hour, we decided to completely wipe out the Route Redistribution configuration on the gateway and to re-build it from scratch, in the exact same way. 

After doing that, the route are advertised correctly.

The issue has been reproduced on all the gateways that we already upgraded from now on (7 gateways).

** ClusterXL VIP ARP issue **

We did upgrade our first cluster from R80.10 to R80.30 and, after dealing with the first issue (Route Redistribution), we found something else.

After the upgrade in R80.30, a failover from the Cluster did generate a full downtime.

After some research, it looks like the ARP Cache on the "other side" (again a Cisco Cat. 9500) was NOT updated. The associated MAC Address to the VIP was still the old one (from the gateway that is now in Standby).

If we force a static ARP Entry on the router side, everything is back to normal.

Precision : we dot NOT use the Virtual MAC option right now.

Does anyone have ever heard about these issues?

Any changes made in R80.30 to the ARP behavior of ClusterXL?

Any advice?

Is the Virtual MAC option recommended for ClusterXL right now? Back it the days, I'am pretty sure it was not, that's why it's not used for the moment.

We are sadly thinking of a rollback in R80.10 right now...

Kind Regards

[G_W_Albrecht]

According to sk50840 - How to enable ClusterXL Virtual MAC (VMAC) mode there should be no issue when using VMAC with CLusterXL !

[JulzorenSen]

We might give it a shot.
Is enabling VirtualMAC disruptive?

[Maarten_Sjouw]

No it is not and highly recommended to use.
Proxy ARP issues were seen after migration to R80.30 though, they completely disappeared and only came back after 3 policy pushes.

[Yair_Shahar]

Hi, I wanted to kindly ask what is the status of this case you had? did you find a solution for the issues you have seen with the upgrade attempt?